Cyber Extortion Charges for Expert Amid FBI Website Hack

Edward Dubrovsky has dedicated years to advising companies on how to respond to cybercriminals who steal sensitive information and demand ransom payments. Now, federal prosecutors have charged the 54-year-old Canadian ransomware negotiator with conspiring to commit cyber extortion himself. Sources close to the investigation indicate that his case is linked to ShinyHunters, the group responsible for defacing the FBI’s jobs website last month and demanding that the agency retract a warning issued in May about their activities.

According to the federal court documents filed in Philadelphia, which incorrectly spell his last name as “Dobrovsky,” Dubrovsky was apprehended in Pennsylvania on Thursday. The complaint, filed in the Eastern District of Texas and currently sealed, accuses him of conspiracy to threaten the confidentiality of information with the aim of extorting money, as well as charges related to Hobbs Act extortion and conspiracy to commit Hobbs Act extortion. A magistrate judge in Philadelphia ordered his detention and sent him to Texas for a hearing. As of now, Dubrovsky has not been convicted nor has he entered a plea, and Politico reported that he could not be contacted for comment.

The public filings do not mention ShinyHunters or the FBI, and during a recent announcement regarding an arrest linked to ShinyHunters, FBI Director Kash Patel did not disclose the suspect’s name. “This is the latest arrest that the FBI has made in a matter of days involving this network as we tirelessly work to dismantle the group, pursue new leads, and gather evidence,” Patel stated on X.

🚨 Our agents in the field have arrested another suspected co-conspirator of the ShinyHunters group – the group believed to be responsible for the recent https://t.co/RG0D4I5KFS incident, which occurred on a platform managed by a third-party vendor.

This is the latest arrest…

— FBI Director Kash Patel (@FBIDirectorKash) October 9, 2026

Two sources familiar with the case informed the New York Times that Dubrovsky was detained on suspicion of being involved in the breach that compromised sensitive data belonging to thousands of FBI employees. Federal authorities consider him a key co-conspirator in ShinyHunters’ attack on the bureau. Similarly, CNN corroborated these claims, linking the defendant to the FBI hack through multiple sources knowledgeable about the investigation. A law enforcement source also told CBS News that the Canadian suspect is believed to have played a direct role.

Politico reported uncertainty regarding whether Dubrovsky’s case is directly related to the FBI hack, although the timing appears to coincide. BleepingComputer noted that the sealed complaint does not clarify his specific actions or whether his case pertains to the breach. The charges outlined in the docket focus on extortion rather than the actual intrusion.

What Is Known About Edward Dubrovsky?

In 2022, when Cypfer, a Toronto-based ransomware recovery firm, appointed Dubrovsky as managing director, a press release highlighted his 30 years of experience in the industry, along with his certifications including CISSP, OSCP, and PMP, and his role on the cybersecurity advisory board at York University. “Clients who fall victim to ransomware need to recover as rapidly as possible,” Dubrovsky stated in the release.

His LinkedIn profile identifies him as the chief operating officer at Cypfer and an “ex-founder,” a title the company disputes. A Cypfer representative informed security journalist Brian Krebs that Dubrovsky was never a founder and served as a managing director until his resignation last November. He is currently associated with CyberSteward, a ransom negotiation firm identified in litigation as a trade name for Cypfer, according to Politico.

Dawg, I’m going to keep it 100% with you. Never in a million years would I have expected a boomer Maple Syrupican to be an active member of an extortion group named after Pokemon https://t.co/4mNBHc9WnJ

— vx-underground (@vxunderground) October 10, 2026

One of Krebs’ sources mentioned that Dubrovsky was in Philadelphia for the Cyber Risk Summit, a cyber insurance conference that concluded the day prior to his arrest, with Cypfer listed as the event’s largest sponsor. “I look forward to continuing discussions around strategies and compliance-driven coercive (ransomware, extortion) advisory, negotiations, and settlement services that are global and truly agnostic,” Dubrovsky wrote in a LinkedIn post about the conference.

Interestingly, he has previously shared a platform with the FBI: an agenda from the InfraGard session at the RSA Conference in April 2025 lists him as a participant alongside agents from the FBI’s San Francisco cyber division.

On September 24, just two days after ShinyHunters publicly disclosed the FBI hack, Dubrovsky released a self-published guide titled *Cyber Extortion Strategic Response*, which focuses on ransomware negotiations.

Details of the ShinyHunters FBI Jobs Site Hack

The ShinyHunters group displayed a fake seizure banner on FBIjobs.gov on September 22. Within 48 hours, media outlets analyzing a leaked spreadsheet containing approximately 5,000 alleged FBI officials discovered records that seemed to identify individuals within the FBI’s own hacking unit. By September 29, an internal memo reviewed by the New York Times instructed staff to prepare for the worst. “We are operating under the assumption that the threat actor is also exfiltrating [personally identifiable information] of all F.B.I. employees,” the memo reportedly stated.

Following the announcement by Dutch police regarding the arrest of an alleged ShinyHunters leader, identified by Krebs as convicted cybercriminal Pepijn van der Stap, FBI Cyber Division Assistant Director Brett Leatherman released a video addressing the remaining members of the group. “Arrests often affect who is willing to cooperate, and seized infrastructure reveals who remains,” Leatherman explained. Van der Stap was detained around September 15, prior to the FBI hack, and the group has denied any connection to him. ShinyHunters has since retracted its implied threat to publish the compromised data.

Jordanian authorities arrested Saif al-Din Khader, a suspected member known as “Rey,” who is reportedly collaborating with the FBI. On Monday, the bureau informed The Register that it had partnered with others to apprehend “multiple subjects.” Leatherman also criticized a contractor who failed to apply a critical security patch to a third-party platform. “Consequently, the FBI has terminated the contractor and taken all necessary measures to mitigate any further risks and protect our workforce,” he stated in a statement reported by ABC News.

The ShinyHunters group has been linked to data breaches since at least 2018, providing services to assist other hackers in extorting their victims. According to Leatherman, the group has breached over 140 organizations and extorted approximately $70 million since last year, as reported by the New York Times.

In August 2025, ShinyHunters was associated with a series of Salesforce database attacks affecting Workday. In December, it extorted Pornhub over the viewing histories of Premium users using data acquired from a breach of analytics vendor Mixpanel. A single voice phishing call in March resulted in the acquisition of around 900,000 records from identity protection firm Aura, which ShinyHunters published online when Aura refused to pay. In May, students logging into Canvas during finals week encountered a ShinyHunters ransom notice in place of their dashboards.

Another Ransomware Negotiator Faces Charges

On the day before Dubrovsky’s arrest, Zohar Pinhasi, owner of the Florida-based firm MonsterCloud, was arraigned in Brooklyn on charges of wire fraud in an unrelated case. Prosecutors allege that his company charged victims for a decryptor it did not possess while secretly paying the hackers instead. They contend that hundreds of companies paid MonsterCloud over $19 million, while Pinhasi transferred more than $8 million in ransoms to cybercriminals. He has pleaded not guilty.

A more relevant case involves Angelo Martino, a former DigitalMint ransomware negotiator who pleaded guilty in April for collaborating with the BlackCat/ALPHV ransomware gang. The attackers compensated Martino for disclosing his clients’ confidential negotiating strategies, and he worked with two other cybersecurity professionals to deploy BlackCat against additional victims, including one who was extorted for about $1.2 million in bitcoin. DigitalMint has stated that it terminated the employees involved.

In July, Martino received a 70-month prison sentence for conspiring to obstruct interstate commerce through extortion, identical to the Hobbs Act statute cited in Dubrovsky’s charges. Sources informed Krebs that the FBI is currently examining devices seized during van der Stap’s arrest in connection with the ShinyHunters investigation and that key figures at other ransomware negotiation firms may soon face similar charges.